                       (.setProvider "BC"))]
       (cond
         (instance? PEMEncryptedKeyPair obj)
-        (->> (.decryptKeyPair obj (decryptor (JcePEMDecryptorProviderBuilder.) passphrase))
+        (->> (.decryptKeyPair ^PEMEncryptedKeyPair obj (.build (JcePEMDecryptorProviderBuilder.) (decryptor passphrase)))
              (.getKeyPair converter)
              (.getPrivate))
         (instance? PEMKeyPair obj)
         (->> (.getKeyPair converter obj)
              (.getPrivate))
         (instance? PKCS8EncryptedPrivateKeyInfo obj)
-        (->> (.decryptPrivateKeyInfo obj (decryptor (JceOpenSSLPKCS8DecryptorProviderBuilder.) passphrase))
+        (->> (.decryptPrivateKeyInfo ^PKCS8EncryptedPrivateKeyInfo obj (.build (JceOpenSSLPKCS8DecryptorProviderBuilder.) (decryptor passphrase)))
              (.getPrivateKey converter))
         (instance? PrivateKeyInfo obj)
         (.getPrivateKey converter obj)

          converter (doto (JcaPEMKeyConverter.)
                      (.setProvider "BC"))]
      (if (instance? X509CertificateHolder keyinfo)
        (.getPublicKey converter (.getSubjectPublicKeyInfo keyinfo))
        (.getPublicKey converter keyinfo)))))


  (Security/addProvider (org.bouncycastle.jce.provider.BouncyCastleProvider.)))

(defn- decryptor
  [^String passphrase]
  (when (nil? passphrase)
    (throw (ex-info "Passphrase is mandatory with encrypted keys." {})))
  (.toCharArray passphrase))

;; TODO: maybe make this functions work with strings instead of reader

